Privacy Policy

1. Who we are & roles

NeoStreamShop is operated by NEOSTREAMSHOP, a French limited liability company (Société à responsabilité limitée — SARL), SIREN 109 404 244, share capital 100,00 €, registered office in 75017 Paris, France.

The Service lets streamers use interactive widgets, overlays, mini-games, coin-based shop products, optional widget subscription plans and related tools on Twitch, Kick and YouTube streams (and compatible broadcasting setups).

• Data controller (Site accounts): For streamer / user accounts created on the Site (identity, wallet, widget configuration, purchases, settings), NEOSTREAMSHOP is the data controller.
• Data processor (live stream / viewer events): When we receive Twitch EventSub, Kick events or donation webhooks and relay them in real time to a streamer’s overlay at that streamer’s request, we act as a data processor on behalf of that streamer. The streamer remains the controller of their viewers’ data and is responsible for informing viewers (for example in their own channel privacy notice) and for the lawfulness of that processing.
• Independent controllers: Platforms and payment providers you use (Twitch, Kick, Google, Gumroad, Ko-fi, Buy Me a Coffee, Discord, etc.) process your data under their own privacy policies as independent controllers for their services.

We have not appointed a Data Protection Officer. Privacy and rights requests should be sent using the contact details in section 17.

2. Scope of this Policy

This Policy covers personal data processed through:

• the Site (browsing, sign-in, account settings, shop, documentation, invite/referral links, widget configuration and overlay URLs);
• authentication with Twitch, Kick and (optionally) Google / YouTube;
• coin purchases and widget subscription plans via Gumroad (including automatic account linking and license-key redemption);
• community coin codes (for example Discord weekly drops);
• donation integrations (Ko-fi, Buy Me a Coffee);
• real-time delivery of stream events to overlays via our WebSocket infrastructure;
• cookie consent and persistent sign-in choices.

It does not govern how Twitch, Kick, YouTube, StreamElements, OBS, Discord, Gumroad or other third-party products process data on their own platforms. If you install NeoStreamShop products through a third-party overlay host (for example StreamElements), that host’s privacy policy also applies to data processed by that host.

3. What data we collect

We collect and process the following categories of personal data, depending on how you use the Service:

3.1 Account & identity

• Twitch: Twitch user ID, login, display name, profile picture URL, channel description and view count as returned by Twitch, plus OAuth access/refresh tokens (stored encrypted) needed to provide the Service. We do not request the Twitch email scope and we force the account email field to remain empty for Twitch sign-in.
• Kick: Kick user ID, username, display name, profile picture URL, channel slug where available, and OAuth tokens (encrypted) needed to subscribe to Kick events for your widgets. You may sign in with Kick only, or link Kick to an existing account.
• Google / YouTube (optional link): Google user ID, display name and profile picture URL, plus tokens (encrypted) needed to maintain the link. We request profile scopes only (not email). We do not access YouTube channel content, videos or live chat through this link. In rare cases, if Google returns an email address in the profile payload without a display name, that value may be used solely as a display-name fallback.
• Internal identifiers: Our internal user ID, WebSocket channel ID used to deliver overlay events, and timestamps such as account creation and last_seen_at (last authenticated visit).

3.2 Widget, shop & wallet data

• Widgets you activate or own, configurations, overlay store data, acquisition/activation records, free monthly / trial / mascot entitlements where applicable, and activation codes you redeem.
• Coin balance and wallet updates when you buy packs, redeem codes, spend coins in the shop, or receive referral bonuses.
• Widget subscription (rental plans): If you subscribe to a Starter / Essential / Pro plan, we store plan identity, status (for example active, cancelled, ended), validity window, Gumroad sale and subscription identifiers, the purchaser email Gumroad provides (see below), and which widget slots you currently assign under that plan.

3.3 Purchases & payment-related data

• Gumroad (payment partner): Coin packs and widget subscriptions are sold through Gumroad. Payment card and billing details are handled by Gumroad, not by us. We store hashed license keys, product/pack identifiers, coins credited, redemption timestamps, and subscription metadata needed to credit your account.
• Linking a subscription to your Site account:
  • Automatic link: When you start checkout while signed in, we pass our internal user ID to Gumroad as a URL parameter (nss_uid). Gumroad includes that value in payment / subscription webhooks so we can activate or renew the plan on the correct account.
  • License-key fallback: If the automatic link fails (for example you paid in another browser, on another device, or from a shared checkout link), you may paste the Gumroad license key from your receipt into the Site (subscription page or account activation field). We verify the key with Gumroad’s API, link the subscription to the signed-in account, and mark the key as used so it cannot be redeemed on another account.
  • Lifecycle events: Gumroad may send us webhooks for sales, renewals, cancellations, restarts, refunds and subscription end. We use them to keep your plan status and access window up to date. After the first successful link, renewals and cancellations are matched mainly via the Gumroad subscription identifier stored on your account.
• Subscription email: When Gumroad sends subscription webhooks or when you redeem a subscription license key, we may store the purchaser email address Gumroad provides (subscription_email) as subscription metadata (support, receipts correlation and account maintenance). This email is provided by Gumroad, not by Twitch or Google OAuth, and we do not use it as the primary way to attach a purchase to a Site account.
• Subscription event log: We keep a technical event journal of Gumroad subscription webhooks and license redemptions (event fingerprint, resource type, sale/subscription/product identifiers and linked user ID when known) for idempotency, abuse prevention and support.
• Community coin codes: If you redeem an NSS-XXXXXXXX code (for example from a Discord drop), we store a hash of the code, prefix, amount, source, expiry and which account redeemed it (the redeeming user link is cleared if the account is later deleted).

3.4 Referral program

• Your referral code, pending referral cookie/session when someone visits an invite link, and the link between inviter and invitee accounts needed to apply referral bonuses (recorded in a redemption journal).

3.5 Donation integrations

• If you connect Ko-fi or Buy Me a Coffee, we store a webhook key, an encrypted verification secret and enablement status so we can receive tip events.
• Donor name, amount, currency and message from those webhooks are processed in real time to trigger your widgets. We do not keep a donation history archive on the Site.

3.6 Stream events & chat (relayed in real time)

• Twitch EventSub (examples): follows, subscriptions, cheers, raids, channel-point redemptions, stream online/offline, and chat messages via channel.chat.message.
• Kick events (examples): chat, follows, subscriptions, rewards and similar events needed for widgets.
• These events may include viewer usernames, user IDs, badges and message text. They are forwarded in real time to your overlay over our WebSocket server. We do not archive chat or event logs as a message history.

3.7 Technical, security & cookie data

• Session: server-side session data and the strictly necessary session cookie so you stay signed in during a visit and forms remain protected (CSRF).
• Persistent sign-in (remember-me): if you accept cookies, a hashed sign-in token, expiry, truncated browser user-agent and truncated IP prefix (not the full IP) for up to 30 days.
• Security & abuse prevention: we may log IP address, user-agent, requested URI and related metadata in short-lived security logs / rate-limit records (rate-limit identifiers are stored hashed) to prevent fraud, abuse and outages.
• Cookie consent choice and, where used, short-lived OAuth state cookies and referral cookies (see section 6).

3.8 Data we do not intentionally collect

• We do not run advertising pixels, marketing analytics suites or cross-site tracking cookies on the Site.
• We do not ask for government ID, precise geolocation, payment card numbers, or special-category data (health, religion, etc.) as part of the Service.
• We do not operate a contact form that collects email on the Site; support / privacy requests are handled via Discord (and post where needed).

4. Why we use your data & legal bases

Under the GDPR / UK GDPR, we rely on the following legal bases:

Where we rely on legitimate interests, we balance those interests against your rights. You may object as described in section 10. We do not use your personal data for third-party advertising.

5. Who we share your data with

We share personal data only as needed to run the Service:

• Twitch, Kick and Google: when you sign in or link accounts, we exchange the data necessary for OAuth and event subscriptions under their terms and privacy policies.
• Gumroad: processes payments and issues license keys / subscription events. Gumroad acts as an independent controller for payment data. When you check out a subscription while signed in, we share our internal user ID with Gumroad via the checkout URL so the purchase can be linked back to your Site account. We receive from Gumroad only what is needed to credit your wallet or subscription (for example product identifiers, sale/subscription IDs, license key, purchaser email, and lifecycle event type).
• Ko-fi / Buy Me a Coffee: if you connect them, they send webhook events to us under their policies. We do not share your NeoStreamShop account data with them beyond the webhook endpoint you configure.
• Hosting & infrastructure: the Site and related services for widgets.neostreamshop.com are hosted on servers operated by OVH SAS (2 rue Kellermann, 59100 Roubaix, France). Real-time widget events are delivered through our WebSocket stack (self-hosted Soketi) on the same EEA infrastructure. These providers act as processors on our instructions.
• Technical content delivery: pages and widgets may load limited third-party technical resources (for example Google Fonts, jsDelivr for certain libraries, and asset hosting on assetsmanager.stream). Those providers may process connection data (such as IP address) as part of delivering the resource.
• Discord: we use Discord as a community and support channel. Messages you send there are processed by Discord under its own policy. Our Discord bot APIs used for community coin drops do not store Discord user IDs in NeoStreamShop account profiles.
• Legal, safety & corporate: we may disclose data if required by law, to protect rights or safety, or in connection with a merger, acquisition or asset sale, subject to applicable law.

We do not sell personal data and we do not share personal data for cross-context behavioural advertising. See also section 11 for California “sale” / “share” wording.

6. Cookies & similar technologies

We use cookies and similar technologies as follows. You can change your choice later via Cookie settings in the Site footer.

We do not use advertising or third-party marketing tracking cookies on this Site. Browser settings may also let you block or delete cookies; blocking strictly necessary cookies may prevent sign-in or parts of the Service from working.

7. International transfers

Your Site account data is hosted and processed in France and the European Economic Area (EEA). Live widget events (chat, alerts, donations) are delivered through our self-hosted WebSocket server (Soketi) in the EEA. We do not use Pusher Cloud for this delivery in the current configuration.

Twitch, Kick, Google, Gumroad, Ko-fi, Buy Me a Coffee, Discord and certain technical CDNs may process data in countries outside the EEA/UK according to their own policies. When we transfer personal data outside the EEA/UK ourselves, we use appropriate safeguards required by law (for example Standard Contractual Clauses and supplementary measures where needed).

8. How long we keep your data

We keep personal data only as long as needed for the purposes above, then delete or anonymise it:

• Active account & widget data: for as long as your account remains active and you use the Service.
• Account deletion: when you delete your account from Account Settings, we delete or anonymise your profile, OAuth tokens, widget configurations, widget store, acquisitions, donation integrations, remember-me tokens, coin-redemption links tied to your user ID, shop sale events tied to your user ID, subscription fields on your account, subscription event rows linked to your user ID, and referral redemption rows, typically within 30 days, and we revoke Twitch / Kick / Google authorizations where technically possible. Cancelling or ending a Gumroad subscription does not by itself delete your Site account. Some technical backups or security logs may take a short additional period to roll off.
• Inactive accounts: if you stop using the Service without deleting your account, we may retain account data for up to 24 months after your last authenticated activity (last_seen_at), then delete or anonymise it, unless a longer period is needed for legal claims or security.
• Payment records: Gumroad retains payment and invoice records as an independent controller under its own retention rules. On our side, after account deletion we remove user-linked redemption rows; we may retain limited anonymised or aggregated records where needed for accounting, tax or dispute handling under French law (which can require retention of commercial records for up to 10 years).
• Subscription metadata & event log: plan status, Gumroad identifiers, purchaser email from Gumroad, slot usage and related webhook / license-redemption journal entries are kept while the subscription relationship is relevant and removed or anonymised with the account, subject to the same legal exceptions (and limited anonymised commercial retention where required).
• Security and technical logs: typically up to 12 months (rate-limit records are short-lived).
• Persistent sign-in tokens: expire after 30 days.
• Cookie consent choice: up to 180 days.
• Referral cookie (nss_ref): up to 30 days.
• OAuth state cookies: a few minutes.
• Stream events and chat: relayed in real time; we do not keep a message history archive.

9. Security

We implement technical and organisational measures appropriate to the risk, including:

• HTTPS for Site traffic;
• encrypted storage of OAuth access/refresh tokens and donation verification secrets;
• hashed storage of remember-me tokens, license keys and rate-limit identifiers;
• CSRF protection on authenticated actions;
• OAuth state validation;
• access controls for administrative tools;
• rate limiting and security event logging to detect abuse.

No method of transmission or storage is perfectly secure. If you believe your account has been compromised, sign out on all sessions where possible, revoke platform authorizations, and contact us promptly.

10. Your rights (EU/EEA, UK & France)

If the GDPR, UK GDPR or French data protection law applies to you, you have the right to:

• Access — obtain confirmation that we process your data and a copy of it.
• Rectification — have inaccurate data corrected. Some profile fields are synced from Twitch, Kick or Google and are best updated on those platforms.
• Erasure — request deletion (“right to be forgotten”). You can delete your account yourself from Account Settings when signed in, or contact us.
• Restriction — ask us to limit processing in certain cases.
• Portability — receive data you provided to us in a structured, commonly used and machine-readable format, where technically feasible. There is currently no self-service export button; contact us and we will provide a portable copy of your account data where the law requires it.
• Object — object to processing based on legitimate interests. You also have an absolute right to object to direct marketing (we do not currently run email marketing campaigns on the Site).
• Withdraw consent — where we rely on consent (for example persistent sign-in cookie, optional account links, donation webhooks), withdraw it at any time without affecting prior lawful processing. Use Cookie settings, disconnect integrations in Account Settings, or contact us.
• Lodge a complaint — with a supervisory authority in your country of residence or work. In France: CNIL (www.cnil.fr). In the UK: the ICO.

To exercise these rights, contact us as described in section 17. We will respond within the time limits required by law (generally one month under the GDPR, extendable where permitted). We may ask you to verify your identity before acting on a request.

Viewers of a stream: if your data appears in a streamer’s chat or alerts relayed by NeoStreamShop, the streamer is typically the controller. Please contact that streamer first for viewer-data requests; we will assist them as processor where appropriate.

11. Additional rights (California & other US states)

If you are a resident of California or another US state with a comprehensive privacy law (for example Virginia, Colorado, Connecticut, Utah or similar), you may have rights to know/access, correct, delete, and obtain a portable copy of personal information, and to opt out of “sale” or “sharing” for cross-context behavioural advertising, subject to exceptions in those laws.

• Categories collected (CCPA/CPRA style): identifiers (platform IDs, usernames, profile image URLs); commercial information (purchases, coin balance, subscription metadata); internet / technical activity (session, cookies, IP/security logs); and audio/visual-adjacent content only insofar as chat/message text is relayed in real time for overlays (not stored as a history).
• Sources: you; Twitch, Kick and Google; Gumroad; Ko-fi / Buy Me a Coffee; your devices/browsers; and (for live relay) platforms delivering stream events.
• Business purposes: providing the Service, security, debugging, short-term transient uses, and complying with law — as described in this Policy.
• Sale / share: we do not sell personal information and we do not share it for cross-context behavioural advertising as those terms are commonly defined. Because we do not engage in that activity, we do not operate a separate “Do Not Sell or Share” opt-out mechanism beyond the controls described here (Cookie settings, account deletion, disconnecting integrations).
• Sensitive personal information: we do not use or disclose sensitive personal information for purposes that require a separate CPRA right-to-limit control beyond what is needed to provide the Service.
• Non-discrimination: we will not discriminate against you for exercising privacy rights.
• Authorized agents: you may designate an authorized agent where state law allows; we may require proof of authorization and identity verification.

Submit requests via the contact channel in section 17. If we deny a request where an appeal right exists under state law, you may appeal by replying to our decision with the word “Appeal”.

12. Other jurisdictions

Depending on where you live, other laws may grant similar rights (for example Brazil’s LGPD, Canada’s PIPEDA / provincial laws, or Australia’s Privacy Act). We apply the same core principles globally: data minimisation, purpose limitation, security, and a practical way to access or delete your Site account data. Contact us and we will handle your request in line with the law that applies to you.

If you access the Service from a country with data localisation or cross-border transfer rules, note that account data is processed in the EEA as described in section 7, and that platform providers you connect may transfer data under their own rules.

13. Children

The Service is aimed at streamers and is not directed at children. We do not knowingly collect personal data from children under 16 (EU/EEA age of digital consent reference we apply) or under the age required by local law (for example under 13 where COPPA applies in the United States).

If you believe a child has provided us personal data, contact us and we will delete it promptly. Platform age requirements (Twitch, Kick, YouTube, Gumroad, etc.) also apply independently of this Policy.

14. Automated decisions & profiling

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you (GDPR Art. 22). Limited automated checks (for example rate limiting, duplicate license-key prevention, marking a subscription license as used after a successful account link, or fraud/abuse signals) are used only to protect the Service and do not profile you for advertising.

15. Third-party services & links

The Site may link to third-party websites and tools (documentation screenshots, Etsy, X/Twitter, Discord, Gumroad checkout, platform developer consoles, StreamElements setup guides, etc.). We are not responsible for their privacy practices. We encourage you to read their policies before providing data to them.

Useful references (non-exhaustive): Twitch, Kick, Google, Gumroad, Ko-fi, Buy Me a Coffee, Discord.

16. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, infrastructure or legal requirements. We will post the updated version on this page and revise the “Last updated” date. For material changes, we may also notify you through the Site where appropriate. Continued use of the Service after an update means you should review the new version; where consent is required for a new optional processing activity, we will ask for it.

17. Contact us

For questions about this Privacy Policy, your personal data, or to exercise your rights, contact:

• NEOSTREAMSHOP (SARL)
• SIREN: 109 404 244
• Registered office: 75017 Paris, France
• Privacy / rights requests: Discord (please mention “Privacy request”)
• Postal contact: written requests may also be sent to the registered office above
• Legal notice: neostreamshop.com legal mentions

We will process your request in accordance with applicable data protection law. We may ask you to verify that you control the relevant Site account or platform identity before acting.